Revealing vulnerability monoculture through systematic adversarial robustness

Existing evaluations cannot give how many different attacks are needed to break a model pool, and thus cannot distinguish shared weaknesses from dispersed failures.

• Setting: The authors state that foundation models share training pipelines, distillation and data, which may form a vulnerability monoculture. Capability enhancement amplifies correlated errors, and applications have entered healthcare, autonomous driving and finance.
• Existing shortcomings: Individual attack success rate assumes per-model attacks, and transfer rate assumes only one input is used. The authors hold that the two cannot distinguish shared exploitable flaws from failures spread across different models.
• Core question: The authors hold that a real adversary lies between the two and will exploit shared vulnerabilities to expand the attack surface. The question to ask is: how many different attacks within a budget can break a given proportion of models in the pool.
• Proposed in this paper: Define Systemic Adversarial Robustness (SAR), written as partial set cover, and estimate it with a greedy procedure over joint attacks. The authors compare collective vulnerability curves before and after distillation on vision models and LLM pools.
• Attack setting:
  • Goal: Make outputs leave the safe region Sy; SAR requires using as few different valid inputs as possible to collectively break at least a 1−δ proportion of models.
  • Knowledge: The main text places the attack in permissive white-box, with oracle access to the target model or model pool.
  • Capability: Perturbations must lie in the valid set. For continuous inputs it is an ℓ∞ ball; token attacks use Levenshtein distance to limit the number of insertions, deletions and substitutions.
  • Victim system: A pool of M deterministic models; a subset of them may be distilled from the same teacher.

Adversarial attacks

• White-box attacks: FGSM of Goodfellow et al. (2015), PGD of Madry et al. (2019), MI-FGSM of Dong et al. (2018), Carlini and Wagner (2017), elastic-net of Chen et al. (2018), and fast adaptive boundary of Croce and Hein (2020a). The paper only lists them.
• Black-box attacks: Square Attack of Andriushchenko et al. (2020), HopSkipJumpAttack of Chen et al. (2020). The authors state that black-box attacks usually rely on the transferability of white-box attacks.
• AutoAttack: Croce and Hein (2020b) use both white-box and black-box attacks to automatically find adversarial examples.

Ensembles in adversarial settings

• Reducing transferability among members: ADP (Pang et al., 2019) uses Shannon entropy regularization; TRS (Yang et al., 2021) lowers loss-gradient similarity; Cui et al. (2022) train members to reduce overlap in vulnerability.
• Diversity training: GAL (Kariyappa and Qureshi, 2019) reduces the dimensionality of the subspace in which adversarial examples lie; DVERGE (Yang et al., 2020) uses a diversity metric to reduce shared vulnerability.
• Theoretical work: Li et al. (2025) give a theoretical characterization and propose iGAT. The paper does not write these ensemble methods as comparison systems of this paper.

Attack transfer

• Early work: Szegedy et al. (2014) observed transfer, Papernot et al. (2016) exploited it, Liu et al. (2017) extended it to larger models, Demontis et al. (2019) gave a theoretical analysis.
• Flat examples: Fan et al. (2024), Zheng et al. (2026), Ge et al. (2023) discuss the relation between flatter adversarial examples and transfer.
• Foundation models: Wei et al. (2022) study transferable attacks on vision Transformers. The paper states that Zou et al. (2023) and Liao and Sun (2024) report that attacks can transfer between aligned LLMs, and that Ma et al. (2024) further report that alignment itself can improve transferability.

Monoculture, homogenization and distillation

• Algorithmic monoculture: Kleinberg and Raghavan (2021) discuss that when many decision-makers converge on the same algorithm, the collective may be worse off.
• Outcome homogenization: Bommasani et al. (2021), Toups et al. (2023), Li et al. (2025) discuss correlated errors under shared data and methods; Goel et al. (2025), Kim et al. (2025) discuss correlated errors after capability enhancement.
• Distillation: Xu et al. (2024) survey LLM knowledge distillation. Cloud et al. (2025) state that distillation can transfer behavioral traits unseen in the training data. Introduction examples: developers distill DeepSeek-R1 into Qwen and Llama; open-source checkpoints from five developers were post-trained on outputs attributed to Claude Opus 4.5.

Comparison setting: The paper does not treat the above attacks or ensemble methods as comparison algorithms for SAR. The empirical comparison is between the parent pool before distillation and the descendant pool after distillation, and against individual ASR. The attacks used for estimation are PGD, AmpleGCG+BEAST, AdvLLM+joint GCG and AutoDAN. The data are MNIST, EMNIST-digits and HarmBench; Table 2 additionally writes AdvBench.

The authors place SAR between single-input transfer and per-model independent robustness: a small SAR means a small number of attacks suffices to cover a given proportion, and a large SAR means failures are spread across different models.

The authors use Systemic Adversarial Robustness (SAR) to measure how many different inputs are minimally needed for a model pool to be collectively broken, rather than how different the models are in construction. The estimation procedure is a top-down greedy over joint attacks, written as partial set cover.

Setting and definition

• Model pool: F contains M deterministic models. Generative models have fixed decoding rules, the paper gives greedy decoding as an example, making each model a deterministic function.
• Perturbation: The valid set for continuous inputs is an ℓ∞ ball. Token sequences use Levenshtein distance, with ε limiting the number of single-token insertions, deletions and substitutions.
• Coverage: C(x′) is the set of model indices broken by that input, i.e. whose output is not in the safe region Sy. A model counts as covered as long as it is broken by at least one input in set V.
• Definition: If no set of inputs can achieve coverage, SAR is defined as 1. Otherwise, SAR_{1-\delta}(F;x,y)=\frac{1}{M}\min\{|V|:\frac{1}{M}|\bigcup_{x'\in V}C(x')|\ge 1-\delta}. It is the minimum number of different valid inputs achieving 1−δ coverage, divided by the pool size. The authors state that a small SAR indicates high shared risk; it does not comment on whether an individual model is robust.

Differences from ASR and transfer coverage

• ASR: Equation (1) is the proportion of a single model broken by one attack algorithm.
• tASC and jASC: tASC(j) in Equation (2) is the coverage on the models in the pool by an attack crafted on model j. jASC(I) is the joint coverage after crafting one input using a set of models I, and tASC(j)=jASC({j}).
• Difference: The authors hold that these quantities either look at a single model or at how many models in the pool a single adversarial input can reach. SAR asks how many different inputs are needed to reach a target coverage.

Top-down greedy

• Algorithm 1: Maintain the uncovered index set I and the covered set R. Each round uses a joint attack to find a valid input on the uncovered models; if it breaks at least one, record that input and remove these models.
• Fallback: If the joint attack breaks none, run a single-model attack on one model in I; if that still fails, treat that model as unbreakable under this attack and remove it. Until the covered count reaches τ=⌈(1−δ)M⌉, or I is empty.
• Return value: When coverage is reached, return k̂/M, where k̂ is the number of inputs selected; otherwise return 1. The authors state that this estimate is an upper bound on the true SAR. The first attack targets the whole pool, and each subsequent one targets the models still uncovered at that time.

Partial set cover and approximation

• Problem (4): Unit-cost partial set cover on the universe [M], where the sets are the coverage of each valid input. When δ=0 it reduces to classical set cover, whose exact computation is generally NP-hard. The sets are only revealed one by one by attacks, and the input returned by an attack is not necessarily the one with the largest marginal coverage.
• α-approximate joint attack: For any non-empty uncovered set, the returned input breaks at least an α proportion of the number that the optimal input on that set could break. α=1 is an exact greedy oracle. When the problem is feasible and the attack satisfies this definition, the authors state that the white-box fallback will not execute; the fallback only guarantees termination when the attack does not meet the definition.
• Theorem 1: When the problem is feasible and the joint attack is α-approximate, k^⋆≤k̂≤(1+(lnτ)/α)k^⋆, where τ=⌈(1−δ)M⌉. The same ratio applies to SAR after dividing by M, and, because it is uniform over instances, applies to the average over the data distribution D. The contribution list writes this factor as the reciprocal of 1+α times ln⌈(1−δ)M⌉, and states that this logarithmic dependence generally cannot be improved further.
• How the authors use the bound: The authors hold that the theorem is not a performance guarantee but an indication of when the procedure's error is bounded. It only bounds the excess of the greedy over the attack error; the attack error generally cannot be bounded, because for a single model any efficient attack with a guaranteed α>0 would decide neural network verification, which is NP-hard (Katz et al., 2017). The authors state that the average α is unobservable, so the theorem is a decomposition rather than a certificate, and is used only as an empirical guide. The contribution list additionally states that the procedure achieves a (1−e to the power −α) proportion of the maximum coverage achievable by k attacks; the appendix writes Theorem 1.

Joint attacks used to estimate SAR

• Images, joint PGD: Untargeted white-box, maximizing the average cross-entropy of uncovered models relative to their respective clean predictions, with ℓ∞ projected gradient ascent. Table 1: 40 steps, step size ε/16, 3 random restarts, returning the one with the highest objective value. On MNIST, Sy is the model's own clean prediction, and a change in prediction counts as broken.
• LLM, joint BEAST: Append a suffix after the harmful request, minimizing the average per-token negative log-likelihood of uncovered models for the target response, using gradient-free beam search. Table 2: beam width 10, seed 20 tokens, suffix 30 tokens, temperature 1, query budget 15,000 per call, at most 4 calls; the seed generator is AmpleGCG-llama2-sourced-llama2-7b-chat.
• Joint GCG and AutoDAN: GCG maximizes the average negative log-likelihood for a fixed refusal, the proposing model rotates within the pool, and suffixes are exchanged as text rather than token ids. Table 3: 20 steps per round, 64 candidates, top 256, 25 HarmBench behaviors. AutoDAN has the attack model rewrite the entire request, treating the target model as a black box and using only text responses; it ranks lexicographically by number broken, mean confidence, and the 20% quantile of confidence. Table 4: the attack model is written as Qwen3.8-27B, temperature 0.8, top-p 0.95, 4 proposals per anchor, 15 HarmBench behaviors.
• LLM success determination: Decoding is deterministic. If the HarmBench Llama-2-13B classifier labels the response as harmful, that model counts as broken. For models that already fail on the unmodified request, they are also counted as broken without using an attack.

Experimental setup

• Vision pools: three levels of diversity, low, medium, and high, each with M=20. The low level changes only the initialization; the medium level additionally changes data augmentation, splits, optimization, and regularization; the high level additionally changes the architecture. Average test accuracy is 98.0%, 98.3%, and 99.2%, respectively. Training uses Adam and early stopping; details are in Appendix A.3.1.
• Vision attacks and distillation: the attack is PGD; Table 1 is 40 steps, step size ε/16, 3 restarts. The teacher is ResNet-18 with 99.5% MNIST test accuracy, used to label 240,000 EMNIST-digits images; the students are the 20 models of the high-diversity pool. The Figure 3 caption says 1,000 random MNIST test images, with coverage target 1−δ=0.85.
• LLM pools: §4 says the small pool has 135M to 5B parameters; Figure 5 shows ten small LLMs, whose names are not listed. The medium pool is five Qwen plus one Llama (M=6); the large pool is eight models from five providers (M=8). Appendix A.3.2 separately lists eight models in the Opus pool and six models in the DeepSeek pool with parameter ranges; the paper does not state whether these are the medium/large pools. The abstract, §4, and Table 6 say Claude Opus 4.6; the introduction, Appendix A.3.2, and Figure 8 say Claude Opus 4.5.
• Main attack and judgment: the main text uses AmpleGCG warm start, then BEAST optimization. Harmful requests are taken from the HarmBench standard category, with deterministic decoding. Jailbreak success is judged by the HarmBench Llama-2-13B classifier. Table 6 is 100 HarmBench behaviors, thinking off. Models that already failed on the unmodified request are counted as jailbroken without an attack.
• Appendix attacks: Figure 6 is AdvLLM+BEAST, Figure 7 is joint GCG, Figure 8 is AutoDAN-RR. Table 3 says 25 HarmBench behaviors; Table 4 says 15, with the attack model Qwen3.8-27B. Table 2 describes the BEAST samples as 25 AdvBench behaviors, which is not the same record as Table 6.
• Metrics: the main report is the estimated systemic robustness k̂/M and its change relative to the original pool, compared against individual ASR or 1−ASR. When the coverage requirement is not met, SAR=1. The paper does not report the number of repetitions; it only says the experiments set seeds.

Main results

The paper does not report per-model SAR; the table below lists only the pool-level mean k̂/M from Table 6. Values in parentheses are changes relative to the original pool, not relative to the previous column. The table omits the large pool at δ=3/8: original pool 0.340, DeepSeek-R1 0.238 (−30.1%), R1→Opus 4.6 0.225 (−33.8%).

| Pool and threshold | Original pool | DeepSeek-R1 | R1→Opus 4.6 | | Medium, δ=0 | 0.543 | 0.512 (−5.8%) | 0.288 (−46.9%) | | Medium, δ=1/6 | 0.385 | 0.363 (−5.6%) | 0.208 (−45.9%) | | Medium, δ=1/3 | 0.270 | 0.267 (−1.2%) | 0.180 (−33.3%) | | Medium, δ=1/2 | 0.203 | 0.202 (−0.8%) | 0.168 (−17.2%) | | Large, δ=0 | 0.676 | 0.509 (−24.8%) | 0.478 (−29.4%) | | Large, δ=1/4 | 0.438 | 0.303 (−30.9%) | 0.279 (−36.3%) | | Large, δ=1/2 | 0.255 | 0.186 (−27.0%) | 0.175 (−31.4%) |

• R1 stage: the authors state that DeepSeek-R1 distillation reduces systemic robustness under AmpleGCG+BEAST. The authors state the maximum decrease is about 6% for the medium pool and up to 31% for the large pool. In Table 6, for R1 only, relative to the original pool, the decrease is −0.8% at δ=1/2 and −1.2% at δ=1/3 for the medium pool; −30.9% at δ=1/4 for the large pool.
• Re-distillation: the authors state that after Opus 4.6 the mean k̂ continues to decrease, and the magnitudes swap: the medium pool loses about another 44% of systemic robustness, while the large pool decreases by only about another 6%. At δ=0, the average number of attack vectors goes from 3.072 to 1.728 for the medium pool and from 4.072 to 3.824 for the large pool. For the R1 stage only, these two numbers go from 3.258 to 3.072 and from 5.408 to 4.072, respectively.
• The authors' comparison: the authors state that no teacher is consistently more harmful: R1 has a larger effect on the large pool, and the subsequent Opus 4.6 has a larger effect on the medium pool. The authors state that on LLMs, SAR reflects pool-level risk better than individual robustness. The Figure 4 caption says lower values mean fewer suffixes are needed to cover the pool, and the dashed line is the mean; the main text does not give the other endpoints on the figure.

MNIST diversity and distillation

• Diversity: the authors state that at ε=0.05, the high-diversity pool has higher SAR than the other two pools, and this gap persists when the perturbation budget is increased. The main text does not give the specific SAR values for Figure 2.
• Distillation and ASR: after teacher labeling, the authors state that at 1−δ=0.85, the number of distinct attacks required decreases while individual attack success does not decrease noticeably, and that SAR and individual ASR can change separately, which is counterintuitive at first. The Figure 3 legend says EMNIST test accuracy goes from 96.3% to 98.8%, and labels +2.6%, −6.6%, −22.9%; after text conversion it cannot be determined which number corresponds to which curve in the left panel. The right panel is titled as the distribution of SAR 0.85, and the text includes mean −22.9%.
• Right-panel text: the Figure 3 right panel also labels med 0.45, SAR=1: 39%, and summaries including mean −6.1%, −12.4%, −16.5%, −22.9%, and SAR=1 from 30% to 20%. The row-by-row correspondence between steps and these summaries may be misaligned in plain text, so each percentage is not bound to a specific step here. The horizontal axis ticks go to 6.4k steps.

Distillation process for the small LLM pool

• Decrease: Figure 5 is fine-tuning of ten small LLMs on DeepSeek-R1 trajectories, with attacks AmpleGCG+BEAST, thinking off. The authors state that SAR0.85 decreases by 15.0% and individual robustness 1−ASR decreases by 5.3%, so SAR decreases faster and more.
• Timing: the authors state that SAR decreases after only 0.05 epochs, while individual robustness decreases only at 0.15 epochs; the main text uses significantly; the paper does not report a significance test. The Figure 5 left panel also labels significant drop from step 16 and from step 47. The paper does not map epochs to steps.
• Other labels in the figure: the legend says held-out R1 trajectory token accuracy goes from 71.5% to 75.8%, and the left panel also has +5.9%, which the main text does not say corresponds to which curve. The right-panel text includes summaries such as med 0.30 to 0.20 and SAR=9/10 of 1% or 0%; the alignment of steps or epochs with these summaries is unreliable, so they are not bound item by item. The authors state that the final distilled pool is less systemically robust at every δ; this sentence corresponds to the right side of Figure 5, and the main text does not give values for each δ.

Other ablations and analyses

• The authors state that in the appendix, AdvLLM warm start plus BEAST, joint GCG, and non-insertion AutoDAN also show the same trend; the Figure 6–7 captions give the direction, and the main text does not give values for these figures.
• The Figure 7 left panel is six parent–descendant lineages, and the right panel is singleton-completed k̂/6; the caption gives no values.
• Figure 8 is the lineage attributed to Claude Opus 4.5; the right panel is singleton-completed systemic risk under AutoDAN-RR; the worst-case sets for parent and descendant are selected separately, with 25 and 22 behaviors, respectively.
• Appendix Table 7: the Opus pool has parameters 4.0–31.2 (median 11.5) B, and the parent is instruction- or reasoning-tuned; the DeepSeek parent is 6 base models without safety alignment, with parameters 1.5–32.8 (median 8.1) B, and the descendant is 1.8–32.8 (median 8.1) B.
• On the three LLM pools, the authors state that fine-tuning on shared teacher trajectories reduces systemic robustness under AmpleGCG+BEAST; this sentence points to the more detailed analysis in Appendix A.3.2, and the main text does not give another overall table.

Limitations and future directions noted by the authors

• Conclusion: the authors state that, although a principled metric is given, characterizing shared vulnerability remains an important and not yet sufficiently studied problem (Conclusion).
• The paper has no dedicated Limitations section. The discussion in the method section about the theorem not being a certificate and attack error generally being unbounded is not written as a limitation or future work, so it is not counted here.

Scope of the experiments

• Vision: three MNIST pools of 20 models each, with test accuracy 98.0%, 98.3%, and 99.2%; PGD is 40 steps with 3 restarts; the budget named in the main text is ε=0.05. The distillation teacher ResNet-18 has 99.5% accuracy and labels 240,000 EMNIST-digits images; the Figure 3 caption is 1,000 random MNIST test images, coverage target 1−δ=0.85, and the horizontal axis ticks go to 6.4k steps.
• LLM pools: §4 says the small pool is 135M–5B and Figure 5 shows ten models; the medium pool has M=6 and the large pool has M=8. Appendix A.3.2 lists the model names of the Opus pool and the DeepSeek pool and the parameter ranges in Table 7; the paper does not state whether these are the same as the medium/large pools. The abstract and Table 6 say Opus 4.6; the introduction, appendix, and Figure 8 say Opus 4.5.
• Attacks and judgment: the main results are AmpleGCG+BEAST, thinking off, the 100 HarmBench behaviors of Table 6, with the HarmBench Llama-2-13B classifier and deterministic decoding. The appendix additionally has AdvLLM+BEAST, joint GCG (Table 3 says 25 HarmBench behaviors), and AutoDAN (Table 4 says 15 behaviors). Table 2 separately says 25 AdvBench behaviors. The main estimate uses a white-box joint attack; AutoDAN treats the target model as a black box and uses only text responses.
• Not reported by the paper: agreement between the classifier and human judgment, per-model SAR, the names of the ten small LLMs, and the number of repetitions. The curve values of Figure 2 and Figures 6–8 are also not given in the main text.
• Reproducibility statement: the Reproducibility Statement says the experiments set seeds and the plotting data has been retained; the authors plan to release code after the review period and do not intend to make the attack vectors used public.

SAR turns “how many distinct attacks are needed at minimum to jailbreak a given proportion of a model pool” into a pool-level metric, used to look at shared vulnerability rather than reporting another single-model ASR.

• Problem: individual ASR corresponds to per-model attacks, and single-input transfer corresponds to one input attacking the whole pool. The authors argue that real adversaries lie between the two, and that shared post-training and distillation may propagate flaws to student models.
• Method: SAR1−δ is the minimum number of valid inputs needed to reach 1−δ coverage divided by M; when no set can cover, it is recorded as 1. Algorithm 1 uses joint attacks for greedy selection and returns an upper bound k̂/M. Under an α-approximate oracle, Theorem 1 bounds the procedure error as no more than 1 plus ln τ divided by a multiple of α.
• Vision: three MNIST pools of 20 models each. The authors state that at ε=0.05 the high-diversity pool has higher SAR, and the gap persists when the budget is increased. After a shared ResNet-18 teacher labels 240,000 EMNIST images, the authors state that the number of distinct attacks required to reach 0.85 coverage decreases, while individual attack success does not decrease noticeably.
• LLM: requests come from HarmBench, judgment uses the Llama-2-13B classifier, and decoding is deterministic. In Table 6 (100 behaviors, thinking off, AmpleGCG+BEAST), the mean k̂/M for the medium pool at δ=0 goes from 0.543 to 0.512 (−5.8%), and to 0.288 (−46.9%) after re-distillation with Opus 4.6; for the large pool at δ=0 it goes from 0.676 to 0.509 (−24.8%), then to 0.478 (−29.4%). On ten small LLMs, the authors state that SAR0.85 decreases by 15.0% and individual robustness decreases by 5.3%.
• The authors' conclusion: the authors report that pools distilled from DeepSeek-R1 and from Claude Opus 4.6 have lower estimated systemic robustness than the corresponding parent pools, and suggest this may be a systemic cost of distilling frontier models. Which teacher is more harmful is not fixed. The authors state that characterizing shared vulnerability remains important and has not yet been sufficiently studied. The abstract and Table 6 say Opus 4.6, while the appendix separately has a lineage that says Opus 4.5.